GDPR

I. Introduction

The General Data Protection Regulation (GDPR) has applied across the European Union since May 25, 2018. As a member state of the EU, Poland is fully subject to the GDPR, which is directly applicable in Polish law and supplemented by the Polish Act on the Protection of Personal Data of May 10, 2018.

The supervisory authority responsible for overseeing, guiding, and enforcing data protection rules in Poland is the UODO (Urząd Ochrony Danych Osobowych – the Polish Data Protection Authority).

Poland has thus established a personal data protection system that fully complies with European Union requirements.

II. Scope

The GDPR applies to:

any data controller or processor established in Poland;

any organization located outside Poland that offers goods or services to individuals located in Poland, or that monitors their behavior in Poland.

Regardless of where the processing takes place, as long as it concerns the personal data of individuals located in Poland, the regulation applies.

It covers both automated and non-automated processing that is part of a file system.

Activities of an exclusively personal or domestic nature are not covered by its scope.

III. Principles of Data Processing

Lawfulness, fairness, and transparency: All processing must have a clear legal basis and be carried out transparently.

Purpose limitation: Data may only be used for specific and legitimate purposes.

Data minimization: Only strictly necessary data should be collected.

Accuracy: Data must be accurate and kept up to date.

Storage limitation: Data must only be kept for as long as strictly necessary and then deleted or anonymized.

Security and confidentiality: Appropriate technical and organizational measures must be implemented to prevent any data breach, alteration, or loss.

IV. Rights of Data Subjects

In accordance with the GDPR and Polish law, natural persons have the following rights:

Right to information and access;

Right to rectification;

Right to erasure (right to be forgotten);

Right to restriction of processing;

Right to data portability;

Right to object.

For minors under 16 years of age (as set by Polish law), the processing of their data requires the consent of a parent or legal guardian, and the information must be provided in clear and understandable language.

V. Obligations of Data Processors

Data processors must:

strictly comply with the written instructions of the data controller;

implement appropriate security measures;

assist the data controller in the performance of its obligations, in particular in responding to requests from data subjects;

notify the data controller without delay of any data breach. The controller must then inform the UODO (Polish Data Protection Authority) within 72 hours.

Data controllers must maintain a record of processing activities and conduct a Data Protection Impact Assessment (DPIA) in cases of high risk.

Some organizations must also appoint a Data Protection Officer (DPO).

VI. International Data Transfers

When a transfer to a non-EU country is envisaged, the data controller must ensure an adequate level of protection. This can be achieved through:

an adequacy decision from the European Commission;

or the signing of Standard Contractual Clauses (SCCs).

Polish companies must use the standard contractual clauses adopted on June 4, 2021, or any other legally recognized mechanism.

VII. Monitoring and Enforcement

The UODO (Polish Data Protection Authority) has broad powers, including:

issuing warnings or formal notices;

restricting or prohibiting certain data processing activities;

imposing fines of up to €20 million or 4% of global annual turnover, whichever is higher.

Polish law also allows individuals to provide instructions regarding the use of their data after their death. Failing this, the processing must comply with applicable regulations.

The Polish GDPR framework aims to guarantee the rights of individuals, strengthen business compliance, and promote trust in the digital environment.